K3S-HOME/security
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
26 Commits 1 Branch 0 Tags
85ef6e8c9f9cff3221108db1126dbaddf1a66ffa
Commit Graph

12 Commits

Author SHA1 Message Date
Mayne0213
85ef6e8c9f CHORE(falco): set Falco CPU limit to empty string 
- Override Helm default CPU limit
- Prevent throttling
 2026-01-04 23:41:39 +09:00
Mayne0213
10211f35bc REFACTOR(falco): remove invalid empty string CPU 
- limit from falco
Kubernetes rejects cpu: "" as invalid quantity format. Will allow
DaemonSet
to be created with default CPU limit, then manually patch and disable
auto-sync.
 2026-01-04 23:41:39 +09:00
Mayne0213
fa98684528 CHORE(falco): set Falco CPU limit to empty string 
- Override Helm default CPU limit
- Prevent throttling
 2026-01-04 23:41:39 +09:00
Mayne0213
1408000e4c REFACTOR(falco): remove cpu limits entirely 
- from vault and falco
- Remove cpu line from limits section (not just set to null)
- Prevents Helm charts from applying default CPU limit values
- Eliminates CPU throttling for infrastructure components
 2026-01-04 23:41:39 +09:00
Mayne0213
9d8a0554c8 FIX(falco): set Falco CPU limit to null 
- Explicitly set CPU limit to null
- Prevent throttling
 2026-01-04 23:41:39 +09:00
Mayne0213
5c0e5364b9 REFACTOR(resources): remove cpu limits 
- from infrastructure components
- velero-ui: Remove 200m CPU limit
- metallb controller: Remove 100m CPU limit
- metallb speaker: Remove 100m CPU limit (300m total across 3 nodes)
- falco: Remove 1000m CPU limit (3000m total across 3 nodes)

Total CPU limits removed: ~3600m

This eliminates CPU throttling and reduces CPU limits overcommit from
131% to 0%.
 2026-01-04 23:41:39 +09:00
Mayne0213
ac5fde6ba4 FIX(repo): simplify ignoreDiff for all StatefulSets 
- Simplify ignoreDifferences configuration
- Reduce complexity
 2026-01-04 23:41:39 +09:00
Mayne0213
70eb551871 FIX(falco): disable selfHeal for Falco 
- Prevent StatefulSet drift issues
- Disable automatic healing
 2026-01-04 23:41:39 +09:00
Mayne0213
3f18a3cdf8 FEAT(repo): enhance syncPolicy and ignoreDiff for StatefulSet 
- Add enhanced sync policy
- Configure ignoreDifferences for StatefulSet
 2026-01-04 23:41:39 +09:00
Mayne0213
c2b9175b8b FIX(storage): improve ignoreDiff for StatefulSet PVC retention 
- Improve ignoreDifferences configuration
- Handle PVC retention policy
 2026-01-04 23:41:39 +09:00
Mayne0213
18dac6b77f FIX(falco): change Falco driver to modern_ebpf 
- Use modern_ebpf driver for kernel 6.14 compatibility
- Fix kernel module issues
 2026-01-04 23:41:39 +09:00
Mayne0213
10308d48d0 FEAT(velero): Add Velero, Falco, 
- and CNPG infrastructure components
Add three critical infrastructure components via GitOps:

- Velero: Backup and disaster recovery solution
  - Configured with Minio S3 backend
  - Daily full cluster backups (30-day retention)
  - Hourly backups for critical namespaces (7-day retention)
  - Credentials managed via External Secrets from Vault

- Falco: Runtime security monitoring
  - eBPF-based threat detection
  - Custom rules for container security
  - Falcosidekick for alert forwarding
  - Prometheus metrics enabled

- CNPG (CloudNativePG): PostgreSQL operator
  - Kubernetes-native PostgreSQL management
  - Automated failover and backups
  - Will replace Bitnami PostgreSQL

All components follow existing GitOps patterns:
- Helm charts deployed via ArgoCD
- Values managed in Git
- Automated sync with selfHeal enabled
 2026-01-04 23:41:39 +09:00